skill-creator

Pass

Audited by Gen Agent Trust Hub on Aug 1, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides utility scripts scripts/init_skill.py and scripts/package_skill.py that perform local file system operations. These scripts use the standard Python pathlib and zipfile modules to initialize skill directories, write template files, and package them into archives. These are standard automation behaviors for a development tool.
  • [SAFE]: The packaging logic in scripts/package_skill.py implements security controls to prevent unauthorized file access. Specifically, it uses an _is_within check to ensure files do not escape the skill's root directory and explicitly rejects symbolic links during the archival process to mitigate path traversal risks.
  • [SAFE]: The validation script scripts/quick_validate.py performs metadata checks on skill frontmatter using a safe YAML loader (if available) or a minimal fallback parser, ensuring the skill conforms to required naming and length constraints without executing untrusted data.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 1, 2026, 09:26 AM
Security Audit — agent-trust-hub — skill-creator